PT-2026-48934 · Cap Go · Cap-Go

Naitik Gupta · Published 2026-06-12 · Updated 2026-06-12 · CVE-2026-53981

NVD

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as password or MFA verification. Attackers can redirect verification to an attacker-controlled email address and subsequently perform a password reset to permanently take over the victim's account.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-53981

Affected Products

Cap-Go

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-53981 · Security Note
• https://github.com/Cap-go/capgo/security/advisories/GHSA-w56g-jv78-hf79 · Vendor Advisory
• https://github.com/Cap-go/capgo/commit/6685e5f11adef257bf3d085e481f4d8ebcec602e · Patch
• https://vulncheck.com/advisories/cap-go-account-takeover-via-unauthenticated-email-change-mechanism · Note